Ampath Laboratories, one of South Africa's largest pathology providers, has confirmed a cyberattack that may have exposed patients' personal information. A group calling itself ByteToBreach claimed the attack on a hacker forum on 13 October and said it copied more than 80 million records.

"Ampath has experienced a cybersecurity incident which we have reasonable grounds to believe may have caused unauthorised access to, or acquisition of, personal information," the company said. It has notified the Information Regulator under POPIA.

Ampath says the information affected may include name and surname, identity number, date of birth, age, sex, language, physical address, email address and mobile number. It may also include medical aid details, such as the scheme name, membership number and option, and payment details, such as payer name, internal reference number, amount and transaction date and time.

Not every record contains every field. Ampath says there is currently no indication that health, diagnostic or clinical information was in the affected data. It brought in external forensic specialists, says the incident has been contained and that there is no sign of ongoing unauthorised access. Its website was offline for part of Tuesday afternoon.

The attackers tell a bigger story. ByteToBreach claims it fully copied 10 of Ampath's 375 databases, covering staff and HR records, several patient databases, finance systems and provider data, stretching from the mid-2000s to today. It says the laboratory's admission table alone held well over 80 million records, and that ransom negotiations were short.

Note that 80 million records is not 80 million people. South Africa has about 63 million people, and a lab records an admission for each visit or test, so one patient can appear many times. The group posted links to what it says are data samples. MyBroadband scanned one and found it full of malware, including backdoors and trojans, so nobody should download them.

MyBroadband's Luis Monzon broke the story, obtained Ampath's statement and reviewed the attackers' forum post, noting that ByteToBreach has also targeted major organisations in Nigeria. Ampath warned that the stolen data could be used for social engineering, impersonation, phishing and email fraud, and urged people to be wary of any request for banking or financial information. MyBroadband also reported this week on a separate cybersecurity incident at a major South African retailer, part of a run of local breaches.

Even without clinical results, this is a dangerous mix. A scammer holding your ID number, date of birth, address, phone number and medical aid membership number can call you sounding exactly like your medical aid, a lab or a doctor's practice, and quote details only they should know. That is the kind of call that leads people to share banking details or one-time PINs.

So the practical advice is the same as in our guide to protecting your bank account before a scammer calls: if anyone contacts you about a test, a payment or your medical aid, hang up and call back on a number you already have. It is also the latest in a pattern.

The RelyComply breach exposed identity documents through a compliance vendor, and now a lab that holds two decades of patient and staff records has been hit. Health records have their own legal retention rules, but the scale here shows how much sensitive data builds up over the years, and every extra year kept is one more year that can be stolen.

For any business, this is a reminder that POPIA asks firms to keep personal information only as long as they need it.

You might also like our piece on AI-built SARS eFiling scams, the POPIA warning about AI at work, and Truecaller's free scam checker.

Get more SA tech and business news and subscribe to The Open Letter.